All things Shopify and commerce
I would like to verify the user who wants to access the admin panel of my Shopify app after the app is already installed in the shop. Shopify delivers a session token as a parameter, if the user wants to access the admin panel. As far as my understanding goes, the session token is exactly for that, to verify the shop and if the user is authenticated at the Shopify site.
What do I do with it? In the manual it is referenced as a JWT token but it does not have the structure header.payload.signature. So I don't really know what to do with it. I don't want to use any foreign library.
I would like to refresh this thread to increase the chance that somebody will see it.
I have the same issue.
I can see some documentation around it. https://shopify.dev/tutorials/authenticate-your-app-using-session-tokens#verify-the-signature
But it is difficult to comprehend it.
Can someone help?
How does your application architecture look like? Do you work with a backend?
a bit more context about your embedded app would be useful.
I use t the getSessionToken function from the app-bridge-utils to obtain session tokens. To validate the token I send it to the backend.
You could decode the jwt token on the client-side using libraries like jwt-decode. If you don't want to use a 3rd party library as you mentioned, you could check the code to learn how jwt tokens are encoded.
To make sure the jwt token was issued by Shopify the signature needs to be verified. This is really important for security reasons. Since your app's secret key was used to sign the token you should validate it in your backend. Otherwise, you would have to expose the secret to the client to perform the validation. That would cause more security issues.
Another idea would be to use the token and call an endpoint of the Shopify Admin API directly (if you don't have a backend). E.g. get the shop configuration. If the call returns a successful response you can be sure that the user has access to your shop.
Just some thoughts. Hope it helps.
As a business owner, have you ever wondered when your customer's first impression of yo...By Skye Jun 6, 2023
We're excited to announce improvements to the threaded messaging experience in our communi...By TyW May 31, 2023
Thank you to everyone who participated in our AMA with Klaviyo. It was great to see so man...By Jacqui May 30, 2023